Microsoft Defender for Office 365

MDO comes in two plans with significantly different capabilities:

• Plan 1 (included in M365 E3 with EOP): Safe Attachments (sandboxing unknown attachments), Safe Links (URL scanning and time-of-click rewriting), anti-phishing policies with impersonation protection, and real-time detections
• Plan 2 (included in M365 E5 / E5 Security): Everything in Plan 1 plus Threat Explorer (full email investigation tool), Automated Investigation and Response (AIR), Attack Simulation Training (phishing simulations with training assignments), Campaign Views (tracking coordinated attack campaigns), and Threat Trackers

For SOC teams that need to investigate email threats and run user training, Plan 2 is essential. Plan 1 provides strong prevention but limited investigation capability.

MDO plans comparison

ZAP is a retroactive protection mechanism that removes malicious emails from mailboxes after they have already been delivered:

• How it works: When new threat intelligence identifies a previously delivered email as malicious (new malware signature, newly identified phishing URL, updated sender reputation), ZAP automatically moves or deletes the message from all mailboxes that received it
• Phishing ZAP: Moves confirmed phishing messages to Junk or Quarantine, even if the user has read the message
• Malware ZAP: Quarantines messages with malware attachments regardless of read status
• Spam ZAP: Moves messages reclassified as spam to the Junk folder
• Timing: ZAP typically executes within 48 hours of delivery, but most actions occur within minutes of new intelligence
• Scope: ZAP works across all Exchange Online mailboxes, including shared mailboxes and Microsoft 365 Groups

ZAP is enabled by default and requires no configuration. You can monitor ZAP actions in Threat Explorer and the email entity page.

ZAP documentation

Anti-phishing impersonation protection detects emails that attempt to impersonate trusted individuals or organisations:

• User impersonation: Protects specific high-value users (CEO, CFO, HR director). Detects when an external sender uses a display name or email address similar to the protected user (e.g., "john.smith@contoso.com" vs "john.srnith@contoso.com")
• Domain impersonation: Detects emails from domains that visually resemble your organisation's domain or partner domains (e.g., "contoso.com" vs "c0ntoso.com")
• Mailbox intelligence: Uses ML trained on each user's communication patterns to detect unusual senders claiming to be known contacts
• Actions: Quarantine the message, move to Junk, add a safety tip banner, redirect to specific mailbox, or deliver with a warning banner

Configure up to 350 protected users and 50 protected domains per anti-phishing policy. Combine with SPF, DKIM, and DMARC email authentication for layered protection.

Anti-phishing policies

Attack Simulation Training (Plan 2) lets you run realistic phishing simulations to measure and improve user resilience:

1. Choose a technique: Credential harvesting, link in attachment, drive-by URL, attachment malware, or OAuth consent grant
2. Select a payload: Use Microsoft's pre-built payloads modeled on real-world attacks, or create custom payloads with your own branding and landing pages
3. Target users: Target specific departments, groups, or the entire organisation. Exclude recent new hires or VIPs if needed.
4. Schedule: Launch immediately or schedule for a future date. Campaigns can run for 1-30 days.
5. Assign training: Users who click the phishing link are automatically assigned security awareness training modules (Microsoft or third-party content)
6. Report: Track click rates, credential submission rates, training completion rates, and improvement over time across campaigns

Best practice: Run monthly simulations with varying techniques, track the repeat clicker rate, and brief leadership on quarterly trends. Industry benchmark for click rates is 10–15% for untrained users, dropping to 2–5% after 6 months of regular simulation.

Attack simulation training

Yes. MDO extends email protection to Microsoft collaboration workloads:

• Safe Attachments for SharePoint, OneDrive, and Teams: Scans files uploaded to these services using the same sandboxing engine as email attachments. Malicious files are quarantined and blocked from download. Users see a warning in the file library.
• Safe Links for Teams: URLs shared in Teams conversations, channels, and group chats are scanned in real time. Malicious links are blocked with a warning page.
• Safe Links for Office apps: URLs in Office documents (Word, Excel, PowerPoint) opened from SharePoint/OneDrive are protected with time-of-click verification.

These protections require Safe Attachments and Safe Links policies to be enabled and are included in both MDO Plan 1 and Plan 2.

Safe Attachments for SPO/Teams

Threat Explorer (Plan 2) is the primary email investigation tool for SOC analysts. It provides a real-time view of all email flowing through your organisation with powerful filtering and investigation capabilities:

• Views: All email, Malware, Phish, Content Malware, and URL clicks. each with dedicated filters and columns
• Deep investigation: Click any email to see full headers, delivery details, detection reasons, URL detonation results, and attachment analysis results
• Remediation actions: Select multiple emails and take bulk actions: soft delete, hard delete, move to junk, or move to inbox (for false positives)
• Campaign detection: Campaign views group related phishing emails by attack pattern, showing the full scope of a coordinated campaign across your organisation
• URL clicks: Track which users clicked specific URLs after delivery, enabling targeted remediation and training

Threat Explorer data is retained for 30 days. For longer-term analysis, use Advanced Hunting in the Defender XDR portal where EmailEvents data is available for threat hunting queries.

Threat Explorer

Email authentication (SPF, DKIM, DMARC) is foundational for email security and works in concert with MDO protections:

• SPF (Sender Policy Framework): DNS TXT record listing authorised email senders for your domain. Prevents sender IP spoofing.
• DKIM (DomainKeys Identified Mail): Cryptographic signature on outbound emails proving the message came from your domain without modification. Microsoft 365 supports DKIM signing with custom domains.
• DMARC (Domain-based Message Authentication, Reporting, and Conformance): Policy that tells receiving servers what to do when SPF/DKIM fail: none (monitor), quarantine, or reject. Start with p=none, analyse reports for 4–8 weeks, then move to p=quarantine and finally p=reject.

All three should be configured for every domain your organisation sends email from. MDO honours DMARC policies from senders and uses them as a signal in its anti-spoofing detection.

Email authentication